Large enterprises typically support complex, dynamic computer networks. A network node in a computer network can originate, route, or receive data. A service, application or other software (generally, a service) running on a network node may depend on functionality provided by another service running at another network node. The other service may, in turn, depend on functionality provided by a third service running at a third network node, fourth service running at a fourth node, and so on.
Knowledge of the behavior of network assets (e.g., network nodes, services) in a computer network can be difficult to acquire. Documentation is often defective or incomplete, as the process of generating and maintaining documentation can be labor-intensive and time-intensive. Furthermore, the roles and purposes of network assets may change in response to evolving business objectives and requirements. To develop an accurate understanding of the behavior of a computer network, the network behavior can be characterized in terms of relationships and communications. Such characterizations of network behavior can then be employed in support of such diverse tasks as fault diagnosis and localization, network architecture and management, and cybersecurity operations.
Similarly, knowledge of dependencies between network assets in a computer network can be important when assessing damage to the network, planning extensions to the network, planning how to recover from a disaster, or otherwise evaluating the current or planned behavior of the network. Knowledge of network dependencies can also help assess criticality, which is a measure of the business importance of a network asset. Information technology personnel are often unaware of dependencies between network assets, however, especially in a large network. Further complicating their jobs, in many cases, a computer network dynamically changes as network assets are added to the network or removed from the network. The dynamic nature of computer networks is illustrated, for example, in cloud computing networks that scale to meet demands with “limitless” resources, in networks of consumer devices (e.g., the so-called Internet of Things), and in enterprise networks in which employees can add their own devices (e.g., according to so-called Bring Your Own Device or Bring Your Own Technology policies). In such computer networks, a large number of network assets may be characterized by spatial transiency, temporal transiency and ephemeral lifetimes.